Sigma rule: Linux Suspicious Child Process from Node.js - React2Shell

Rule

Title

Linux Suspicious Child Process from Node.js - React2Shell

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

Date

2025-12-05

File

rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.

Log source

product

linux

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '/node'
    ParentCommandLine|contains:
        - '--experimental-https'
        - '--experimental-next-config-strip-types'
        - '/node_modules/next'
        - 'next dev'
        - 'next start'
        - 'node_modules/.bin'
        - 'react-scripts start'
        - 'start-server.js'
selection_generic_child_img:
    # Observed when child_process.spawn(), child_process.exec(), child_process.execFile(), or child_process.fork() method is used to spawn suspicious processes in exploit
    - Image|endswith:
          - '/busybox'
          - '/cat'
          - '/curl'
          - '/dash'
          - '/dig'
          - '/head'
          - '/id'
          - '/ifconfig'
          - '/ip'
          - '/java'
          - '/less'
          - '/lua'
          - '/more'
          - '/nc'
          - '/ncat'
          - '/netcat'
          - '/netstat'
          - '/nslookup'
          - '/perl'
          - '/ping'
          - '/python'
          - '/python2'
          - '/ruby'
          - '/socat'
          - '/tail'
          - '/wget'
          - '/whoami'
    - Image|contains: '/python'
selection_generic_child_cli:
    # Observed when child_process.execSync() is used to spawn suspicious processes
    # Reference: https://nodejs.org/api/child_process.html#child_processexecsynccommand-options
    # By default, the cli will look something like `/bin/sh -c .......`
    CommandLine|contains:
        - '/dev/tcp/'
        - '/dev/udp/'
        - '/etc/hosts'
        - '/etc/passwd'
        - '/etc/shadow'
        - 'base64'
        - 'cat '
        - 'curl'
        - 'dig'
        - 'ifconfig'
        - 'IO::Socket::INET'
        - 'java'
        - 'less '
        - 'lua'
        - 'mkfifo '
        - 'more'
        - 'nc '
        - 'ncat'
        - 'netcat'
        - 'netstat'
        - 'nslookup'
        - 'perl'
        - 'php'
        - 'ping'
        - 'ps -ef'
        - 'ps aux'
        - 'python'
        - 'rcat'
        - 'ruby'
        - 'sh -i 2>&1'
        - '-c id'
        - 'socat'
        - 'uname'
        - 'wget'
        - 'whoami'
selection_specific_sh:
    Image|endswith: '/sh'
selection_specific_cli:
    Image|endswith: '-c'
filter_main_default_shell_flag:
    Image|endswith: '-c'
condition:
    selection_parent and
    (
        1 of selection_generic_*
        or
        (selection_specific_sh and not filter_main_default_shell_flag)
        or
        (all of selection_specific_* and selection_generic_child_cli)
    )

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059
• attack.initial-access
• attack.t1190
• detection.emerging-threats
• cve.2025-55182

CVEs this rule names

• CVE-2025-55182

MITRE ATT&CK ids this rule names

• T1059
• T1190

Related rules

• 271de298-cc0e-4842-acd8-079a0a99ea65 (similar)

References

• https://github.com/msanft/CVE-2025-55182
• https://nodejs.org/api/child_process.html#class-childprocess
• https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
• https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml